It is possible to define roles for users. Based on this roles, components with an `action` attribute like a button can be hidden or disabled for the current user.

The behavior can be defined in the `security-annotation` element in the `tobago-config.xml`. Posible values are `hide`, `disable` and `ignore`.

To allow an action only for a specific role, you have to annotate a method with `@RolesAllowed({"role1", "role2"})`. This method must not have a parameter.

Also, the name of the beans must be distinct. Tobago only read an el expression once and put it in the cache including the annotation. After that, Tobago only work with the cache.

There are different ways to define roles for Tomcat and Jetty.

Roles are defined in a tomcat-users.xml within the `<tomcat-users>` tag.

<tomcat-users> <user username="guest" password="guest" roles="demo-guest"/> <user username="admin" password="admin" roles="demo-admin"/> </tomcat-users>

For Jetty, roles are defined in a config file. This config file could be set in the configuration of the jetty-plugin in the pom file.

# username: password [,rolename ...] guest: guest,demo-guest admin: admin,demo-admin

In this example there are two content boxes. The left one is for admin users. The right one is for guests and admins.

If you run the demo on your local machine, you may change the scope of the `RoleController` from `@SessionScoped` to `@ApplicationScoped`. In that case, the guest can read the text added by the admin.

This is a box only for admins. A text can be added in the input field. The submit button is only enabled for admin users. Notice, that the method set in the `action` attribute of the `<tc:button/>` have the annotation `@RolesAllowed({"admin"})`.

This is a box for guests and admins. It displays the text which is set by an admin on the left. You also can hit the logout button to login again.